Internet Engineering Task Force (IETF) S. Kiesel Request for Comments: 7723 University of Stuttgart Category: Standards Track R. Penno ISSN: 2070-1721 Cisco Systems, Inc. January 2016 Port Control Protocol (PCP) Anycast Addresses Abstract The Port Control Protocol (PCP) anycast addresses enable PCP clients to transmit signaling messages to their closest PCP-aware on-path NAT, firewall, or other middlebox without having to learn the IP address of that middlebox via some external channel. This document establishes one well-known IPv4 address and one well-known IPv6 address to be used as PCP anycast addresses. Status of This Memo This is an Internet Standards Track document. This document is a product of the Internet Engineering Task Force (IETF). It represents the consensus of the IETF community. It has received public review and has been approved for publication by the Internet Engineering Steering Group (IESG). Further information on Internet Standards is available in Section 2 of RFC 5741. Information about the current status of this document, any errata, and how to provide feedback on it may be obtained at http://www.rfc-editor.org/info/rfc7723. Copyright Notice Copyright (c) 2016 IETF Trust and the persons identified as the document authors. All rights reserved. This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License. Kiesel & Penno Standards Track [Page 1] RFC 7723 PCP Anycast Addresses January 2016 Table of Contents 1. Introduction . 2 2. PCP Server Discovery Based on Well-Known IP Address . 3 2.1. PCP Discovery Client Behavior . 3 2.2. PCP Discovery Server Behavior . 3 3. Deployment Considerations . 4 4. IANA Considerations . 5 4.1. Registration of an IPv4 Special-Purpose Address . 5 4.2. Registration of an IPv6 Special-Purpose Address . 5 5. Security Considerations . 6 5.1. Information Leakage through Anycast . 6 5.2. Hijacking of PCP Messages Sent to Anycast Addresses . 6 6. References . 7 6.1. Normative References . 7 6.2. Informative References . 7 Acknowledgements . 8 Authors' Addresses . 9 1. Introduction The Port Control Protocol (PCP) [RFC6887] provides a mechanism to control how incoming packets are forwarded by upstream devices such as Network Address and Protocol Translation from IPv6 Clients to IPv4 Servers (NAT64), Network Address Translation from IPv4 to IPv4 (NAT44), and IPv6 and IPv4 firewall devices. Furthermore, it provides a mechanism to reduce application keepalive traffic [PCP-OPTIMIZE]. The PCP base protocol document [RFC6887] specifies the message formats used, but the address to which a client sends its request is either assumed to be the default router (which is appropriate in a typical single-link residential network) or has to be configured otherwise via some external mechanism, such as a configuration file or a DHCP option [RFC7291]. This document follows a different approach: it establishes two well- known anycast addresses for the PCP server, one IPv4 address and one IPv6 address. PCP clients usually send PCP requests to these well- known addresses if no other PCP server addresses are known or after communication attempts to such other addresses have failed. The anycast addresses are allocated from pools of special-purpose IP addresses (see Section 4), in accordance with Section 3.4 of [RFC4085]. Yet, a means to disable or override these well-known addresses (e.g., a configuration file option) should be available in implementations. Kiesel & Penno Standards Track [Page 2] RFC 7723 PCP Anycast Addresses January 2016 Using an anycast address is particularly useful in larger network topologies. For example, if the PCP-enabled NAT/firewall function is not located on the client's default gateway but further upstream in a Carrier-Grade NAT (CGN), sending PCP requests to the default gateway's IP address will not have the desired effect. When using a configuration file or the DHCP option to learn the PCP server's IP address, this file or the DHCP server configuration must reflect the network topology and the router and CGN configuration. This may be cumbersome to achieve and maintain. If there is more than one upstream CGN and traffic is routed using a dynamic routing protocol such as OSPF, this approach may not be feasible at all, as it cannot provide timely information regarding which CGN to interact with. In contrast, when using the PCP anycast address, the PCP request will travel through the network like any other packet (i.e., without any special support from DNS, DHCP, other routers, or anything else) until it reaches the PCP-capable device that receives it, handles it, and sends back a reply. A further advantage of using an anycast address instead of a DHCP option is that the anycast address can be hard-coded into the application. There is no need for an application programming interface that passes the PCP server's address from the operating system's DHCP client to the application. For further discussion of deployment considerations, see Section 3. 2. PCP Server Discovery Based on Well-Known IP Address 2.1. PCP Discovery Client Behavior PCP clients can add the PCP anycast addresses, which are defined in Sections 4.1 and 4.2, after the default router list (for IPv4 and IPv6) to the list of PCP server(s) (see step 2 in Section 8.1 of [RFC6887]). This list is processed as specified in [RFC7488]. Note: If, in some specific scenario, it was desirable to use only the anycast address (and not the default router), this could be achieved by putting the anycast address into the configuration file or DHCP option. 2.2. PCP Discovery Server Behavior PCP servers can be configured to listen on the anycast addresses for incoming PCP requests. When a PCP server receives a PCP request destined for an anycast address it supports, it sends the corresponding PCP replies using that same anycast address as the source address (see the "How UDP and TCP Use Anycasting" section of [RFC1546] for further discussion). Kiesel & Penno Standards Track [Page 3] RFC 7723 PCP Anycast Addresses January 2016 3. Deployment Considerations For general recommendations regarding operation of anycast services, see [RFC4786]. Architectural considerations of IP anycast are discussed in [RFC7094]. In some deployment scenarios, using PCP anycasting may have certain limitations that can be overcome by using additional mechanisms or by using other PCP server discovery methods instead, such as DHCP [RFC7291] or a configuration file. One important example is a network topology in which a network is connected to one or more upstream network(s) via several parallel firewalls, each individually controlled by its own PCP server. Even if all of these PCP servers are configured for anycasting, only one will receive the messages sent by a given client, depending on the state of the routing tables. As long as routing is always symmetric, i.e., all upstream and downstream packets from/to that client are routed through this very same firewall, communication will be possible as expected. If there is a routing change, a PCP client using PCP anycasting might start interacting with a different PCP server. From the PCP client's point of view, this would be the same as a PCP server reboot and the client could detect it by examining the Epoch field during the next PCP response or ANNOUNCE message. The client would re-establish the firewall rules and packet flows could resume. If, however, routing is asymmetric, upstream packets from a client traverse a different firewall than the downstream packets to that client. Establishing policy rules in only one of these two firewalls by means of PCP anycasting will not have the desired result of allowing bidirectional connectivity. One solution approach to overcome this problem is an implementation-specific mechanism to synchronize state between all firewalls at the border of a network, i.e., a PEER message sent to any of these PCP servers would establish rules in all firewalls. Another approach would be to use a different discovery mechanism (e.g., DHCP or a configuration file) that allows a PCP client to acquire a list of all PCP servers controlling the parallel firewalls and configure each of them individually. PCP anycast as such allows a PCP client to communicate only with its closest upstream PCP server. However, it may be used in conjunction with the PCP proxy function [RFC7648], in order to support scenarios with cascaded PCP-enabled NATs or firewalls. Kiesel & Penno Standards Track [Page 4] RFC 7723 PCP Anycast Addresses January 2016 4. IANA Considerations 4.1. Registration of an IPv4 Special-Purpose Address IANA has assigned a single IPv4 address from the 192.0.0.0/24 prefix and registered it in the "IANA IPv4 Special-Purpose Address Registry" [RFC6890]. +----------------------+-------------------------------------------+ | Attribute | Value | +----------------------+-------------------------------------------+ | Address Block | 192.0.0.9/32 | | Name | Port Control Protocol Anycast | | RFC | RFC 7723 (this document) | | Allocation Date | October 2015 | | Termination Date | N/A | | Source | True | | Destination | True | | Forwardable